Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

ANNOUNCEMENT: Answers is being migrated to a brand new platform! answers.splunk.com will be read-only from 5:00pm PDT June 4th - 9:00am PDT June 9th. Please read this Answers thread for all details about the migration.

Welcome to Splunk Answers! Not what you were looking for? Refine your search.

Converting unique IDs into chart column names

0

Hi All

This is my second SOS this week as I get acquainted with Splunk. I've exhausted all possibilities trying to solve this problem... I'm part way there and I'd hoping someone can provide inspiration or enlightenment.

My problem is when it comes to charting the 5 most recent builds. I'd like 5 columns called: "Latest Build", "Latest Build -1"....... "Latest Build -4".Under each of these columns, we'd see a 'Success' or 'Fail' status with a separate row for each service.

I am having a lot of difficultly trying to reconcile the unique Build IDs to the 5 columns representing the most recent build history.

When I use "Chart over by" or "xyseries" I get 10 columns if I chart the Service 1 and Service 2 example above - I can't figure out how to rename the columns.When I use "transpose", I can rename the columns; I can get the outcome I want when I report build history against a single service, but I have problems when I try to chart build history for multiple services.

People who like this

1 Answer

Looking at your search, not quite sure why you need a join since both searches in the join have similar search terms. Most probably your existing search could be rewritten as below. Please have a look and see if it yields the same result

Renjith, thanks very much for such a supremely detailed answer. I came across streamstats on Friday evening and thought that would present a way forward - you've really helped me accelerate towards achieving what I need to! I do also think the events we are generating and the data we are indexing could do with some revision, which would make life easier... :-)

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.